Microsoft
Monthly
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows a low-privileged authenticated attacker to gain full control of an affected system through a use-after-free memory corruption condition. The vulnerability spans virtually the entire supported Windows ecosystem, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit identified at time of analysis, and Microsoft has released patches addressing the flaw across all affected builds.
Heap-based buffer overflow in the Windows USB Audio Class kernel driver (usbaudio.sys) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and requires no user interaction beyond the attacker's own session. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via Microsoft Update.
Local privilege escalation in Windows NTFS exposes a use-after-free condition in the kernel-mode filesystem driver, allowing an authenticated local attacker with low privileges to achieve full SYSTEM-level control. The vulnerability spans virtually the entire supported Windows ecosystem - from Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable in enterprise environments. No public exploit or CISA KEV listing has been identified at time of analysis, though the AC:H rating suggests exploitation requires a specific timing or memory-layout condition such as a race condition, limiting opportunistic mass exploitation.
Heap-based buffer overflow in the Windows Online Certificate Status Protocol (OCSP) component allows a locally authenticated attacker to elevate privileges to SYSTEM on affected Windows Server and Windows 10 systems. The vulnerability spans a wide range of Microsoft platforms from Windows Server 2012 through Windows Server 2025, with Microsoft patching confirmed via MSRC. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and CVSS High-complexity (AC:H) significantly limits opportunistic exploitation.
Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a locally authenticated, low-privileged attacker to escalate privileges on the local machine. The flaw spans an exceptionally broad range of Windows client and server releases - from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released targeted patches for all affected build lines; no public exploit code or active exploitation has been identified at time of analysis, though the full CIA:H impact and unchanged scope confirm full local system compromise is the end-state if exploited.
Local privilege escalation in the Windows CD-ROM kernel driver (cdrom.sys) enables a standard authenticated user to achieve SYSTEM-level access across virtually all supported Windows versions from Server 2012 through Windows 11 25H2 and Windows Server 2025. The root cause is CWE-125 out-of-bounds read, which in a kernel driver context can expose memory contents and be chained into privilege escalation via kernel structure corruption. Microsoft has released patched builds; no confirmed active exploitation or public proof-of-concept has been identified at time of analysis.
Use-after-free in the Windows Work Folder Service enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases. The flaw (CWE-416) requires high attack complexity - consistent with a race condition - and local access, but grants full confidentiality, integrity, and availability impact upon successful exploitation. A vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow (CWE-122) in Microsoft Office Word enables unauthenticated remote code execution when a victim opens a specially crafted document. All currently supported Office product lines are affected across Windows (x86/x64) and macOS, including Microsoft 365 Apps for Enterprise, Office 2016, 2019, 2021 LTSC, 2024 LTSC, and Microsoft 365 for Mac. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected products and full C/I/A impact make this a high-priority patching item across virtually all enterprise environments.
Privilege escalation in Windows Hyper-V allows a network-adjacent low-privileged attacker to gain full system control (C:H/I:H/A:H) by exploiting a missing authorization check. The flaw, rooted in CWE-862 (Missing Authorization), requires the attacker to already hold a low-privilege account and to trigger user interaction, placing it at CVSS 7.1 with high complexity. Microsoft has released patches across the full range of affected Windows 10, Windows 11, and Windows Server builds; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows DNS Server allows a network-authenticated attacker to trigger a use-after-free condition in the DNS service, resulting in full system compromise with high confidentiality, integrity, and availability impact. The vulnerability affects Windows Server versions spanning 2012 through 2025 as well as select Windows 10 builds, making it broadly relevant across enterprise Active Directory environments. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all listed versions.
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver allows an authenticated low-privilege user to gain SYSTEM-level access across a wide range of Windows 10, Windows 11, and Windows Server versions via an out-of-bounds read (CWE-125) in the kernel-mode driver. The vulnerability spans over a dozen currently-supported Windows releases including Server 2019, 2022, and 2025. No public exploit or CISA KEV listing has been identified; Microsoft has released patches through its standard update channels.
Heap-based buffer overflow in Windows DHCP Server allows a network-authenticated attacker with low privileges to achieve remote code execution across all major Windows Server releases. The vulnerability (CWE-122) is triggered via crafted DHCP protocol input to the server service, with CVSS 8.8 reflecting the high-impact, network-reachable, low-complexity exploitation path. Microsoft has released patches across a wide range of affected builds. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Privilege escalation in the Windows SMB Client component of Windows 11 26H1 allows a locally authenticated attacker with standard user privileges to gain full SYSTEM-level control via a heap-based buffer overflow (CWE-122). The vulnerability is constrained to local attack vectors, meaning remote unauthenticated exploitation is not possible. Microsoft has released a patch (build 10.0.28000.2954); no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Camera Frame Server Monitor service enables a local authenticated user to elevate privileges to SYSTEM on Windows 11 and Windows Server 2025. Exploitation requires only a standard user account and no user interaction, making it a reliable post-exploitation privilege escalation primitive. Microsoft has released patches addressing all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Audio Service (AudioSrv) exploits a use-after-free condition (CWE-416) to allow an authenticated local attacker to gain SYSTEM-level privileges on unpatched Windows 10, Windows 11, and Windows Server 2019-2025 systems. The attack requires low user privileges and high complexity to execute, consistent with a race condition in the service's memory management. Microsoft has released patches across all affected Windows versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows Remote Desktop Services (RDS) allows a low-privileged authenticated network attacker to execute arbitrary code by exploiting a use-after-free condition (CWE-416) in the RDS processing stack. The flaw spans an exceptionally wide range of Microsoft platforms - from Windows Server 2012 through Server 2025 and Windows 10/11 across multiple feature-update releases - making patch coverage operationally demanding for large Windows estates. No CISA KEV listing and no public exploit code have been identified at time of analysis; however, RDP-facing vulnerabilities historically attract rapid weaponization after disclosure.
Local privilege escalation in Windows Spaceport.sys, the kernel-mode Storage Spaces driver, allows an authenticated low-privileged local attacker to execute arbitrary code in kernel context, achieving full SYSTEM-level control with no user interaction. The flaw is an out-of-bounds read (CWE-125) in the kernel driver, exploitable across virtually every supported and extended-support Windows release from Server 2012 through Windows 11 26H1 and Server 2025. Microsoft has released patched builds for all affected versions; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote code execution in Windows Remote Desktop Services (RDS) is possible through a use-after-free memory condition exploitable by a network-authenticated, low-privilege attacker. Affected platforms span Windows Server 2025 and Windows 11 versions 23H2 through 26H1, with fixed builds specified per-release in the MSRC advisory. The CVSS 7.1 score reflects genuine barriers - high attack complexity (AC:H) and required user interaction (UI:R) - despite full C/I/A impact potential; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Spaceport.sys (the Storage Spaces kernel driver) allows a low-privileged authenticated attacker to achieve full system compromise via a numeric truncation error that triggers a heap-based buffer overflow. The vulnerability affects Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 across multiple feature updates, with fixed build numbers confirmed by Microsoft through MSRC. No public exploit identified at time of analysis, but the local LPE class in kernel drivers is historically a high-priority target for post-exploitation toolkits.
Command injection in the Windows Program Compatibility Assistant (PCA) Service enables local privilege escalation across a broad range of Windows 10, Windows 11, and Windows Server editions. An authenticated low-privilege attacker can inject shell commands through the PCA service's unsanitized input handling (CWE-77), achieving full control of the local system with C:H/I:H/A:H impact. No public exploit code or CISA KEV listing is identified at time of analysis, but the wide Windows install base and low exploitation complexity make patching high priority.
Privilege escalation via an out-of-bounds read in the Windows NTFS kernel driver (CWE-125) enables a local attacker with standard user-level access to gain SYSTEM-level control of the affected host. The vulnerability spans an exceptionally broad range of Windows versions - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making virtually every unpatched Windows environment in the field potentially exposed. Microsoft has confirmed and released patches via MSRC; no public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Access enables remote code execution when a user opens a specially crafted Access database file. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) confirms unauthenticated network delivery requiring only a single user interaction - consistent with a malicious file attachment or download attack pattern. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full-triad impact (C:H/I:H/A:H) and broad affected version range spanning Office 2016 through Microsoft 365 Apps make this a high-priority patch-cycle item.
Privilege escalation in Windows Shell affects Windows 11 (versions 23H2 through 26H1) and Windows Server 2025, enabling a locally authenticated low-privileged attacker to achieve full system compromise with no user interaction required. The root cause is CWE-306 - a critical internal Shell function that lacks an authentication or authorization gate, allowing a standard user account to invoke privileged operations and elevate to SYSTEM. No public exploit code or CISA KEV listing exists at time of analysis; Microsoft has issued patches via Windows Update.
Remote code execution in Microsoft Windows Remote Desktop Services stems from a use-after-free (CWE-416) that a network attacker can trigger without authentication or user interaction to run arbitrary code on the target host. It affects a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through Server 2025), and Microsoft has released fixes. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in Windows Active Directory Domain Services allows unauthenticated network attackers to exploit a use-after-free memory corruption flaw and execute arbitrary code on domain controllers. The vulnerability spans virtually the entire Windows Server ecosystem from 2012 through 2025 and extends to Windows 10 and Windows 11 client builds running AD DS components, creating an exceptionally broad attack surface across enterprise environments. Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Visual Studio and .NET affects multiple release branches and allows a remote unauthenticated attacker to execute arbitrary code on a victim's machine when the victim interacts with malicious content. Affected scope spans Visual Studio 2022 (17.14.x), Visual Studio 2026 (18.9.x), and the full current .NET runtime family (8.0, 9.0, 10.0, 11.0 RC1) as well as legacy .NET Framework branches from 3.5 through 4.8.1. Microsoft has released patches for all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Remote Desktop Protocol (RDP) affects virtually every supported Windows version, from Server 2012 R2 through Windows 11 26H1 and Server 2025, enabling unauthenticated remote code execution when a victim initiates an RDP connection. The CWE-122 flaw corrupts heap memory during RDP protocol processing, allowing an attacker to hijack execution flow and achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit has been identified at time of analysis; a vendor-released patch is available across all affected Windows release tracks.
Use-after-free in the Windows Wireless Networking subsystem enables a locally authenticated low-privileged attacker to escalate to full system privileges on a wide range of Windows 10, Windows 11, and Windows Server editions. The vulnerability carries CVSS 7.0 (AV:L/AC:H/PR:L) reflecting that exploitation is locally constrained and requires navigating high-complexity timing conditions typical of UAF race conditions, but the resulting impact is complete C/I/A compromise. Microsoft has released patches across all affected release branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Remote Desktop Services (RDS) enables low-privilege authenticated network attackers to achieve remote code execution across a broad range of Windows client and server platforms, from Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the attack requires an authenticated session and elevated exploitation complexity, yielding a base score of 7.5. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available covering 19 distinct OS build lines.
Local privilege escalation in Windows Error Reporting (WER) allows a low-privileged authenticated user to gain SYSTEM-level access via a heap-based buffer overflow. The vulnerability affects a wide range of Windows desktop and server editions from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low-complexity, no-interaction CVSS vector makes this a practical post-exploitation stepping stone.
Heap-based buffer overflow in Spaceport.sys - the Windows kernel-mode driver for Storage Spaces - allows a low-privileged authenticated attacker to escalate to SYSTEM-level privileges over a network, with full confidentiality, integrity, and availability impact. Every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 is affected before the patched builds. Microsoft has released patches via the MSRC advisory; no public exploit or CISA KEV entry has been identified at time of analysis.
Remote code execution in Windows Media Foundation exposes virtually all supported Windows releases to heap buffer overflow exploitation via network-delivered media content. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates an unauthenticated attacker can trigger the flaw by enticing a user to open or stream a maliciously crafted media file, resulting in full confidentiality, integrity, and availability compromise of the affected process. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in the Windows DHCP Server role enables unauthenticated remote code execution across Windows Server versions spanning 2012 through 2025. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network exploitation without authentication or user interaction, moderated by high attack complexity requiring precise exploitation conditions. Microsoft has released patched builds for all confirmed affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Fax Service (CWE-122) enables local privilege escalation to SYSTEM on a broad range of Windows client and server editions spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated low-privileged local user can trigger the overflow with low attack complexity (AC:L), achieving full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in the Windows MIDI Service Module enables local privilege escalation on Windows 11 systems across three major release branches. An authenticated local attacker with standard user privileges (PR:L) can trigger the overflow with low complexity and no user interaction, achieving full SYSTEM-level compromise (C:H/I:H/A:H). Microsoft has released patches covering Windows 11 versions 24H2, 25H2, and 26H1; no public exploit or KEV listing is present at time of analysis.
Privilege escalation via out-of-bounds read in Windows NTFS affects a broad range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An authorized (low-privilege) network attacker who can trigger specific NTFS parsing behavior - requiring user interaction - can achieve full compromise of confidentiality, integrity, and availability, effectively gaining system-level access. No public exploit has been identified at the time of analysis, but a vendor-released patch is available and should be prioritized given the breadth of affected OS versions.
Stack-based buffer overflow in the Windows USB Driver allows an authenticated low-privileged attacker to escalate privileges to SYSTEM-level access, with the CVSS vector indicating network-based exploitation (AV:N) requiring user interaction. The vulnerability affects a wide range of Windows versions from Windows 10 1809 through Windows 11 25H2/26H1 and Windows Server 2019 through 2025. No public exploit code has been identified at time of analysis, and the attack vector's network classification combined with a USB driver component is atypical - likely involving USB-over-network redirection features (e.g., Hyper-V or Remote Desktop USB redirection) rather than physical USB enumeration.
Local privilege escalation in Windows Secure Kernel Mode exploits an untrusted pointer dereference (CWE-822) to allow a low-privileged local attacker to elevate to full kernel-level control across a broad range of Windows 10, 11, and Server releases. The Secure Kernel Mode (SKM) context - part of Windows Virtualization-Based Security (VBS) operating at Virtual Trust Level 1 (VTL1) - means successful exploitation bypasses standard OS-kernel isolation, making this structurally more severe than a conventional LPE. No public exploit identified at time of analysis; vendor-released patches are available via Microsoft's July 2026 security update cycle.
Local privilege escalation in Windows Image Acquisition (WIA) through a use-after-free memory corruption flaw allows a low-privileged authenticated local user to gain full SYSTEM-level control. The vulnerability spans an exceptionally broad range of Microsoft Windows releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch scope significant across virtually all enterprise Windows environments. No public exploit code or CISA KEV listing has been identified at time of analysis, and the high attack complexity rating (AC:H) suggests reliable exploitation requires precise timing or heap manipulation skill.
Remote code execution in Windows Imaging Component (WIC) is possible via an integer overflow (CWE-190) triggered when processing a maliciously crafted image file, affecting virtually every supported and legacy Windows release from Server 2012 through Windows 11 26H1. An unauthenticated network-based attacker can deliver a specially crafted image that causes an integer wraparound in WIC's parsing logic, leading to arbitrary code execution in the context of the target user. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of affected platforms and low attack complexity make this a high-priority patching target.
Privilege escalation in the Windows Win32K kernel-mode GUI subsystem allows a low-privileged local user to gain SYSTEM-level access via a use-after-free memory corruption condition. The vulnerability affects a broad span of Windows 10, Windows 11, and Windows Server 2019/2022/2025 releases, making it highly relevant to enterprise endpoint and server environments. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected version branches.
Remote code execution in the Windows Compressed Folder (zipfldr / built-in ZIP shell handler) affects a broad range of supported Windows client and server releases, from Windows Server 2012 and Windows 10 through Windows 11 25H2/26H1 and Windows Server 2025. A heap-based buffer overflow (CWE-122) in the archive-parsing code lets an attacker who delivers a crafted compressed archive corrupt heap memory and execute arbitrary code. Microsoft rates it CVSS 9.8; the flaw was reported by Microsoft's own MSRC and a patch is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in the Windows Event Logging Service enables network-accessible, unauthenticated code execution with full system impact across a sweeping range of Windows client and server releases. The flaw (CWE-122) resides in the Event Logging Service - a privileged, always-running Windows component - and can be exploited by a remote attacker who induces a victim user to trigger the vulnerable code path, yielding complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected OS versions and the ubiquity of Windows deployments make this a high-priority patching candidate.
Remote code execution via a heap-based buffer overflow in the Windows Event Logging Service (CWE-122) affects a sweeping range of Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025. An unauthenticated network attacker can trigger the vulnerability with user interaction, achieving full system compromise (C:H/I:H/A:H). No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch availability makes remediation immediately actionable.
Remote code execution in the Windows Event Logging Service (EventLog) affects a broad range of currently-supported Windows client and server editions, from Windows 10 1607/1809/21H2/22H2 and Windows 11 through 26H1, to Windows Server 2012 through Server 2025. An out-of-bounds read in the service's network-facing parsing path allows an unauthorized attacker to execute code over the network per Microsoft's advisory, which rates it CVSS 9.8. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the pre-auth, network-reachable profile makes it a high patch-priority item.
Heap-based buffer overflow in the Windows Partition Management Driver (partmgr.sys) enables a low-privileged local attacker to escalate privileges to SYSTEM or kernel level across virtually all supported Windows client and server releases. Exploitation requires existing low-privileged code execution on the target and high attack complexity, consistent with a race condition or precise heap-grooming technique. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Microsoft DirectMusic component of Windows (spanning Windows 10, 11 through version 26H1, and Windows Server 2012 through 2025) allows an unauthorized attacker to execute arbitrary code by triggering a heap-based buffer overflow (CWE-122). Microsoft rates it 9.8 (AV:N/AC:L/PR:N/UI:N) and has released patches; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. DirectMusic is a legacy multimedia audio subsystem, so exploitation typically flows through malicious media content processed by the DirectMusic parser.
Heap-based buffer overflow in Windows Biometric Service (WinBioSvc) enables a low-privileged local attacker to escalate privileges to SYSTEM level. The vulnerability (CWE-122) affects an extremely wide surface - fifteen distinct Windows 10, Windows 11, and Windows Server release trains from Server 2016 through Server 2025 - making it relevant to virtually every Windows enterprise environment. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches through Windows Update.
Local privilege escalation in the Windows Device Association Service allows a low-privileged attacker to gain SYSTEM-level access on unpatched systems via a use-after-free memory corruption bug (CWE-416). The vulnerability spans the entire current Windows ecosystem - from Windows 10 1607 and Server 2012 R2 through Windows 11 25H2 and Server 2025 - making the attack surface extremely broad. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows Remote Desktop Client (mstsc.exe and related components) allows a low-privileged attacker to execute arbitrary code on the victim client machine via a network connection. The root cause is CWE-908 (use of uninitialized resource), where memory that has not been properly initialized can be manipulated by a malicious RDP server to hijack execution flow on the connecting client. The vulnerability affects the RDP client component across a broad range of Windows releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. No public exploit or KEV listing has been identified at time of analysis, but the CVSS score of 8.8 and high C/I/A impact make this a priority patching target.
Windows Error Reporting (WER) across a broad range of Windows 10, Windows 11, and Windows Server releases creates temporary files in directories with insecure permissions, enabling a local attacker with standard user privileges to tamper with those files and read their contents. The vulnerability is classified as CWE-379 and carries a CVSS 3.1 score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impact achievable without elevated rights. No public exploit code has been identified at time of analysis, and Microsoft has released patches through its standard update channel.
Privilege escalation via heap-based buffer overflow in Windows Enterprise App Management affects a broad swath of Windows desktop and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated network attacker with low privileges who can induce a target user to interact with a crafted payload can trigger the overflow and achieve full system-level compromise (High C/I/A). No public exploit code or CISA KEV listing was identified at time of analysis, but the breadth of affected Windows versions and the vendor-released patch signal a systemic component-level flaw.
Privilege escalation to SYSTEM-level via a heap-based buffer overflow in the Windows Partition Management Driver affects multiple Windows 10, Windows 11, and Windows Server releases. An authenticated local attacker with low privileges can exploit the CWE-122 heap overflow to achieve full confidentiality, integrity, and availability impact on the local system. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Heap-based buffer overflow in the Windows NTFS filesystem driver allows a local, unprivileged attacker to execute arbitrary code with full system impact. The vulnerability (CWE-122) affects an exceptionally wide range of Microsoft Windows and Windows Server releases, from Windows Server 2012 through Windows Server 2025 and Windows 10/11. The CVSS vector (AV:L/PR:N) suggests exploitation is achievable without a Windows account - consistent with a crafted NTFS volume triggering the overflow on mount, such as via removable media. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches.
Heap-based buffer overflow in the Windows Device Association Service enables a low-privileged local user to escalate privileges to SYSTEM level across a broad range of Windows desktop and server platforms. Affected versions span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2016 through 2025 - all prior to their respective patched builds detailed in the Microsoft MSRC advisory. Microsoft has released patches via the standard update channel; no public exploit code or CISA KEV active-exploitation listing has been confirmed at time of analysis.
Heap-based buffer overflow in Microsoft Office Access enables local code execution with full system impact when a low-privileged user opens a specially crafted database file. Affected products span Access 2016 through Microsoft 365 Apps for Enterprise, covering the majority of Microsoft Office deployments. Microsoft has released patches across all affected product lines; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WinBio) affects all major Windows 10, Windows 11, and Windows Server editions from version 1607 through Server 2025. An authenticated local attacker exploiting this vulnerability can corrupt heap structures within the privileged WinBio process to execute arbitrary code at SYSTEM level. No public exploit has been identified at time of analysis, and Microsoft has released patches across all fifteen affected version and edition combinations.
Privilege escalation in Windows Remote Desktop Services exploits an untrusted pointer dereference (CWE-822) to allow a locally authenticated low-privileged attacker to gain full system control (C:H/I:H/A:H). The flaw affects a broad swath of Windows versions from Server 2012 through Server 2025 and Windows 10/11 across multiple feature update branches. No public exploit code or active exploitation has been identified at time of analysis, but Microsoft has released patches via the standard update cycle.
Privilege escalation in the Windows Kernel via a use-after-free memory corruption flaw allows an authenticated local attacker to elevate from low-privileged user to SYSTEM-level access. The vulnerability spans the entire current Windows ecosystem - from legacy Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly relevant to enterprise patch management. No public exploit code or active exploitation has been identified at time of analysis, but the breadth of affected OS versions and the practical value of local EoP payloads in post-initial-access attack chains make timely patching essential.
Use-after-free in the Windows Human Interface Devices kernel subsystem allows a local, low-privileged user to escalate to SYSTEM-level control. Affecting virtually all current Windows desktop and server releases - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), Windows Server 2016 through 2025 - successful exploitation requires local session access and precise timing but yields full C:H/I:H/A:H kernel impact. No active exploitation has been confirmed (no CISA KEV listing) and no public proof-of-concept is known; Microsoft has released patches for all affected build branches.
Local privilege escalation in the Windows Connected User Experiences and Telemetry service (DiagTrack/utcsvc) exposes a use-after-free memory condition allowing an authenticated local attacker to achieve full SYSTEM-level control. The vulnerability carries CVSS 7.0 with AC:H, indicating a race-condition or timing-dependent trigger that elevates exploitation difficulty but does not preclude reliable use in post-breach scenarios. Microsoft has released patched builds across all affected Windows client and server SKUs; no public exploit code has been identified at time of analysis.
Local privilege escalation in the Windows Volume Manager Extension Driver allows a low-privileged authenticated user to gain full SYSTEM-level control via a heap-based buffer overflow (CWE-122). The vulnerability spans an exceptionally wide range of Windows versions - from the legacy Windows Server 2012 and Windows 10 1607 through the current Windows 11 26H1 and Windows Server 2025 - making patching scope a significant operational challenge. No public exploit code or CISA KEV listing has been identified at the time of analysis, and the CVSS AC:H metric reflects meaningful exploitation complexity, but the vulnerability's kernel-mode scope and full C:H/I:H/A:H impact make it a high-value post-compromise tool.
Stack-based buffer overflow in the Microsoft Graphics Component enables a locally authenticated attacker with standard user privileges to escalate to full system control across Windows 10 and Windows 11. The flaw (CWE-121) is triggered locally with low complexity and no user interaction, yielding high confidentiality, integrity, and availability impact per the CVSS:3.1 vector. No public exploit code or CISA KEV listing is identified at time of analysis, but the low-privilege requirement and zero interaction needed make this a realistic post-compromise escalation primitive.
Local privilege escalation in the Windows Kernel across virtually all supported Windows releases exploits a time-of-check time-of-use (TOCTOU) race condition (CWE-367) to elevate from low-privilege user to SYSTEM. An authenticated local attacker wins a race between when the kernel validates a resource and when it uses it, substituting a different object between those two moments. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected versions as part of a coordinated update cycle.
Remote code execution in Microsoft SharePoint Server Subscription Edition is reachable by authenticated network users due to missing authorization checks (CWE-862). An attacker holding any valid SharePoint credentials can invoke privileged server-side functionality without proper authz enforcement, achieving full compromise of confidentiality, integrity, and availability. No active exploitation is confirmed in CISA KEV at time of analysis, and no public exploit code has been identified.
Privilege escalation in Microsoft SharePoint Server Subscription Edition enables any authenticated network user to gain elevated privileges with full confidentiality, integrity, and availability impact. The root cause is CWE-250 (Execution with Unnecessary Privileges), where a SharePoint service or component operates with more privilege than its function requires, allowing a low-privileged account to cross privilege boundaries. No active exploitation has been confirmed and no public exploit code has been identified; a vendor patch is available targeting build 16.0.20326.20090.
Remote code execution in the Windows NTFS file-system driver stems from a heap-based buffer overflow (CWE-122) reachable by an unauthorized attacker over a network, per Microsoft's advisory. The flaw affects a very broad range of supported Windows client and server builds from Windows Server 2012 through Server 2025 and Windows 10/11 up to version 26H1. Microsoft rates it CVSS 9.8 and has released patches; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in Windows Error Reporting (WER) enables network-based privilege escalation across a broad range of Windows desktop and server versions. An authenticated low-privileged attacker who can trigger user interaction can exploit the overflow to achieve full confidentiality, integrity, and availability compromise - effectively gaining SYSTEM-level control. No public exploit code has been identified at time of analysis, but the breadth of affected versions (Windows 10 through Server 2025) and the ubiquity of WER in Windows deployments make this a high-priority patch item.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables remote code execution across a broad range of Microsoft Windows desktop and server editions. An unauthenticated network attacker can trigger the overflow with user interaction, achieving full compromise of confidentiality, integrity, and availability on the target system. The vendor-confirmed patch is available via Microsoft's update channel; no active exploitation or public exploit code has been identified at time of analysis.
Use-after-free in Windows Modern Device Management (MDM) enables a low-privileged authenticated attacker to escalate to SYSTEM-level privileges across a broad swath of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:N/AC:H/PR:L/UI:R) indicates the attack is network-reachable but constrained by high exploitation complexity and required user interaction, limiting opportunistic mass exploitation. Microsoft has released patched builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Power Dependency Coordinator component allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server systems. The flaw (CWE-122) requires only a local account and no user interaction, making it a reliable post-compromise escalation primitive. No public exploit code has been identified at time of analysis, and it does not appear in the CISA KEV catalog, but the low attack complexity (AC:L) and broad platform coverage across Windows 10 through Server 2025 make patching a priority in any environment where insider threat or malware post-exploitation is a concern.
Privilege escalation via out-of-bounds read in Windows BitLocker affects a broad swath of Microsoft operating systems from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature updates. A low-privileged network-authenticated attacker who can induce user interaction can trigger CWE-125 memory reads beyond buffer boundaries in the BitLocker component, ultimately achieving elevation of privileges with full confidentiality, integrity, and availability impact (CVSS 8.0). No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches addressing all confirmed affected versions.
Heap-based buffer overflow in Microsoft Windows Speech (CWE-122) allows a local low-privileged attacker to escalate to SYSTEM-level privileges with no user interaction required. The vulnerability spans the entire modern Windows platform - Windows 10 (versions 1607 through 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2016 through 2025 - making the attack surface exceptionally broad. No public exploit code or CISA KEV entry has been identified at time of analysis; however, the vendor patch is confirmed available via MSRC.
Heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service enables local privilege escalation to SYSTEM on a broad range of Windows desktop and server editions, from Windows 10 1607 through Windows 11 26H1 and Server 2012 R2 through Server 2025. An authenticated attacker with a low-privilege local foothold can exploit the overflow with low complexity and no user interaction, achieving full confidentiality, integrity, and availability compromise (CVSS 7.8, AV:L/AC:L/PR:L). No public exploit identified at time of analysis, and Microsoft has released patches across all affected product lines via MSRC.
Use-after-free in Windows Management Instrumentation (WMI) enables an authenticated low-privilege attacker operating over a network to escalate privileges on affected systems, with full confidentiality, integrity, and availability impact when successfully exploited. The CVSS vector (AC:H/UI:R) reflects meaningful exploitation complexity - a specific race condition must be won and some form of user interaction is required, constraining opportunistic mass exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions - from Server 2012 to Server 2025 and Windows 10/11 across all current branches - makes patch prioritization important for enterprise environments.
Local privilege escalation in Windows Error Reporting (WER) across virtually all supported Windows releases exploits an out-of-bounds read (CWE-125) to allow a low-privileged authenticated local user to gain SYSTEM-level access with full confidentiality, integrity, and availability impact. The breadth of affected platforms is significant, spanning Windows 10 versions 1607 through 22H2, Windows 11 versions 23H2 through 26H1, and Windows Server 2012 through Server 2025 including Server Core installations. No public exploit code has been identified at time of analysis, and Microsoft has released patches through the standard Windows Update channel.
Privilege escalation in the Windows Bluetooth Service allows a low-privileged local attacker to gain SYSTEM-level access by exploiting a race condition in shared resource handling. Affected versions span Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022, and Windows Server 2025. Microsoft has released patched builds; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows Audio Service (AudioSrv) enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on affected Windows 11 and Windows Server 2025 builds. The vulnerability (CWE-122) carries a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting low exploitation complexity once a local foothold is established. Microsoft has released patches across all affected build lines; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Path traversal in the Windows Compressed Folder built-in ZIP handler allows a locally authenticated standard user to escalate privileges to SYSTEM or Administrator level across a wide range of Windows client and server editions. The vulnerability (CWE-22) exists in the component that processes ZIP archive extraction, enabling crafted archive entries to write files outside the intended extraction directory into sensitive system paths. No public exploit or KEV listing exists at time of analysis, but the low attack complexity and broad version coverage across Windows 10, 11, and Server 2012 through 2025 make this a high-priority patching target in environments where local privilege escalation is a concern.
Heap-based buffer overflow in Microsoft Windows Speech enables local privilege escalation across Windows 10, Windows 11, and Windows Server platforms from 2016 through 2025. An authorized local attacker holding only a standard user account can exploit the CWE-122 flaw without user interaction to obtain full system compromise (C:H/I:H/A:H), effectively achieving SYSTEM-level privileges. Vendor-supplied patches are available via MSRC; no public exploit code has been identified at time of analysis.
Out-of-bounds read in the Windows Device Health Attestation (DHA) service exposes sensitive memory contents to unauthenticated remote attackers. The flaw affects Windows 10 Version 1809, Windows Server 2019, 2022, and 2025, where a crafted network request can trigger the read beyond an allocated buffer, leaking high-confidentiality data. Microsoft has released patches for all affected builds, and no public exploit or active exploitation has been identified at time of analysis.
Remote code execution in Microsoft Office exposes unauthenticated network attackers to full system compromise when a target user opens a specially crafted document. The root cause is a heap-based buffer overflow (CWE-122) in Office's document parsing logic, affecting Office 2016 through Microsoft 365 Apps for Enterprise across a defined range of 16.x builds confirmed by EUVD-2026-73711. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 8.8 score with a network attack vector and no required attacker privileges - beyond inducing user file-open interaction - reflects a credible, high-impact threat against the world's most widely deployed office productivity suite.
Local privilege escalation in Windows Installer (msiexec) allows a low-privileged authenticated user to gain full SYSTEM-level control by exploiting a race condition on a shared resource during installer operations. The vulnerability is present across a broad swath of Windows desktop and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CVSS High score (7.0) and full C:H/I:H/A:H impact reflect the severity of a successful escalation.
Privilege escalation in the Windows MIDI Service Module on Windows 11 enables a low-privileged local attacker to gain full system control by exploiting a time-of-check time-of-use (TOCTOU) race condition (CWE-367). Affected builds span all three actively supported Windows 11 release tracks - 24H2, 25H2, and 26H1 - and Microsoft has released patches for each. No public exploit code or CISA KEV listing has been identified at time of analysis, so exploitation at scale is not currently confirmed.
Remote code execution in Microsoft JScript's numeric type conversion logic allows unauthenticated network attackers to execute arbitrary code on affected Windows hosts. The vulnerability stems from CWE-681 (incorrect conversion between numeric types) in jscript.dll, the legacy Windows scripting engine, and affects the full span of supported Windows releases from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit has been identified at time of analysis, but the network-reachable, zero-interaction CVSS vector (AV:N/UI:N) indicates exploitation via server-side JScript processing contexts such as IIS Classic ASP, without requiring user interaction.
Privilege escalation in Windows Error Reporting (WER) via a heap-based buffer overflow (CWE-122) allows an authenticated local attacker - holding only standard user privileges - to achieve full system compromise across all current Windows 10, Windows 11, and Windows Server 2019/2022/2025 builds. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects low attack complexity and no interaction requirement, making this an effective land-and-escalate primitive for threat actors with any initial foothold on a target host. Vendor patch is available from Microsoft; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows URL Moniker (urlmon.dll) enables remote code execution across nearly every supported Windows release when a user interacts with attacker-controlled content. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 across all major feature updates, making the attack surface exceptionally broad. No public exploit or CISA KEV listing has been identified at time of analysis, but vendor patch availability and the network-accessible, user-interaction-triggered attack vector place this firmly in the urgent-patching tier.
Heap-based buffer overflow in Windows Error Reporting (WER) enables a locally authenticated attacker to escalate privileges to SYSTEM or administrative level on affected Windows endpoints and servers. The vulnerability spans virtually the entire supported Windows ecosystem - from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025 - making the blast radius exceptionally broad. No public exploit code has been identified at time of analysis, but the local privilege escalation primitive is highly valuable for post-compromise attackers pivoting from user-level access.
Privilege escalation to SYSTEM via heap-based buffer overflow in the Windows Volume Manager Driver (a kernel-mode component) affects virtually every supported Windows client and server release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An attacker with an existing low-privileged local account can trigger the overflow to corrupt kernel heap structures and gain full SYSTEM-level control without any user interaction. Microsoft has released patches across all affected product lines; the vulnerability carries a CVSS 7.8 local privilege escalation rating with low attack complexity.
Use-after-free in Windows Embedded Mode Service allows a locally authenticated attacker with low privileges to escalate to SYSTEM-level access across virtually all supported Windows versions. The memory corruption occurs when the service accesses a previously freed object, enabling an attacker to manipulate heap layout and execute code in a privileged context. No public exploit or active exploitation (KEV) has been identified; Microsoft has released patches via Windows Update, and the AC:H rating reflects the timing-dependent race-condition exploitation typical of UAF primitives.
Local privilege escalation in the Windows Universal Disk Format File System Driver (UDFS) allows a low-privileged authenticated attacker to gain full control of an affected system through a use-after-free memory corruption condition. The vulnerability spans virtually the entire supported Windows ecosystem, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit identified at time of analysis, and Microsoft has released patches addressing the flaw across all affected builds.
Heap-based buffer overflow in the Windows USB Audio Class kernel driver (usbaudio.sys) enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on affected Windows hosts. The vulnerability spans virtually every supported Windows release from Server 2012 through Windows 11 26H1 and requires no user interaction beyond the attacker's own session. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via Microsoft Update.
Local privilege escalation in Windows NTFS exposes a use-after-free condition in the kernel-mode filesystem driver, allowing an authenticated local attacker with low privileges to achieve full SYSTEM-level control. The vulnerability spans virtually the entire supported Windows ecosystem - from Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly applicable in enterprise environments. No public exploit or CISA KEV listing has been identified at time of analysis, though the AC:H rating suggests exploitation requires a specific timing or memory-layout condition such as a race condition, limiting opportunistic mass exploitation.
Heap-based buffer overflow in the Windows Online Certificate Status Protocol (OCSP) component allows a locally authenticated attacker to elevate privileges to SYSTEM on affected Windows Server and Windows 10 systems. The vulnerability spans a wide range of Microsoft platforms from Windows Server 2012 through Windows Server 2025, with Microsoft patching confirmed via MSRC. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and CVSS High-complexity (AC:H) significantly limits opportunistic exploitation.
Heap-based buffer overflow in the Windows Program Compatibility Assistant (PCA) Service enables a locally authenticated, low-privileged attacker to escalate privileges on the local machine. The flaw spans an exceptionally broad range of Windows client and server releases - from Windows 10 version 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. Microsoft has released targeted patches for all affected build lines; no public exploit code or active exploitation has been identified at time of analysis, though the full CIA:H impact and unchanged scope confirm full local system compromise is the end-state if exploited.
Local privilege escalation in the Windows CD-ROM kernel driver (cdrom.sys) enables a standard authenticated user to achieve SYSTEM-level access across virtually all supported Windows versions from Server 2012 through Windows 11 25H2 and Windows Server 2025. The root cause is CWE-125 out-of-bounds read, which in a kernel driver context can expose memory contents and be chained into privilege escalation via kernel structure corruption. Microsoft has released patched builds; no confirmed active exploitation or public proof-of-concept has been identified at time of analysis.
Use-after-free in the Windows Work Folder Service enables a locally authenticated, low-privileged attacker to escalate privileges to SYSTEM on a broad range of Windows client and server releases. The flaw (CWE-416) requires high attack complexity - consistent with a race condition - and local access, but grants full confidentiality, integrity, and availability impact upon successful exploitation. A vendor patch is available; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow (CWE-122) in Microsoft Office Word enables unauthenticated remote code execution when a victim opens a specially crafted document. All currently supported Office product lines are affected across Windows (x86/x64) and macOS, including Microsoft 365 Apps for Enterprise, Office 2016, 2019, 2021 LTSC, 2024 LTSC, and Microsoft 365 for Mac. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected products and full C/I/A impact make this a high-priority patching item across virtually all enterprise environments.
Privilege escalation in Windows Hyper-V allows a network-adjacent low-privileged attacker to gain full system control (C:H/I:H/A:H) by exploiting a missing authorization check. The flaw, rooted in CWE-862 (Missing Authorization), requires the attacker to already hold a low-privilege account and to trigger user interaction, placing it at CVSS 7.1 with high complexity. Microsoft has released patches across the full range of affected Windows 10, Windows 11, and Windows Server builds; no public exploit or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows DNS Server allows a network-authenticated attacker to trigger a use-after-free condition in the DNS service, resulting in full system compromise with high confidentiality, integrity, and availability impact. The vulnerability affects Windows Server versions spanning 2012 through 2025 as well as select Windows 10 builds, making it broadly relevant across enterprise Active Directory environments. No public exploit code has been identified at time of analysis, and Microsoft has released patches addressing all listed versions.
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver allows an authenticated low-privilege user to gain SYSTEM-level access across a wide range of Windows 10, Windows 11, and Windows Server versions via an out-of-bounds read (CWE-125) in the kernel-mode driver. The vulnerability spans over a dozen currently-supported Windows releases including Server 2019, 2022, and 2025. No public exploit or CISA KEV listing has been identified; Microsoft has released patches through its standard update channels.
Heap-based buffer overflow in Windows DHCP Server allows a network-authenticated attacker with low privileges to achieve remote code execution across all major Windows Server releases. The vulnerability (CWE-122) is triggered via crafted DHCP protocol input to the server service, with CVSS 8.8 reflecting the high-impact, network-reachable, low-complexity exploitation path. Microsoft has released patches across a wide range of affected builds. No public exploit identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Privilege escalation in the Windows SMB Client component of Windows 11 26H1 allows a locally authenticated attacker with standard user privileges to gain full SYSTEM-level control via a heap-based buffer overflow (CWE-122). The vulnerability is constrained to local attack vectors, meaning remote unauthenticated exploitation is not possible. Microsoft has released a patch (build 10.0.28000.2954); no public exploit code or active exploitation has been identified at time of analysis.
Heap-based buffer overflow in the Windows Camera Frame Server Monitor service enables a local authenticated user to elevate privileges to SYSTEM on Windows 11 and Windows Server 2025. Exploitation requires only a standard user account and no user interaction, making it a reliable post-exploitation privilege escalation primitive. Microsoft has released patches addressing all affected builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Audio Service (AudioSrv) exploits a use-after-free condition (CWE-416) to allow an authenticated local attacker to gain SYSTEM-level privileges on unpatched Windows 10, Windows 11, and Windows Server 2019-2025 systems. The attack requires low user privileges and high complexity to execute, consistent with a race condition in the service's memory management. Microsoft has released patches across all affected Windows versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Windows Remote Desktop Services (RDS) allows a low-privileged authenticated network attacker to execute arbitrary code by exploiting a use-after-free condition (CWE-416) in the RDS processing stack. The flaw spans an exceptionally wide range of Microsoft platforms - from Windows Server 2012 through Server 2025 and Windows 10/11 across multiple feature-update releases - making patch coverage operationally demanding for large Windows estates. No CISA KEV listing and no public exploit code have been identified at time of analysis; however, RDP-facing vulnerabilities historically attract rapid weaponization after disclosure.
Local privilege escalation in Windows Spaceport.sys, the kernel-mode Storage Spaces driver, allows an authenticated low-privileged local attacker to execute arbitrary code in kernel context, achieving full SYSTEM-level control with no user interaction. The flaw is an out-of-bounds read (CWE-125) in the kernel driver, exploitable across virtually every supported and extended-support Windows release from Server 2012 through Windows 11 26H1 and Server 2025. Microsoft has released patched builds for all affected versions; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Remote code execution in Windows Remote Desktop Services (RDS) is possible through a use-after-free memory condition exploitable by a network-authenticated, low-privilege attacker. Affected platforms span Windows Server 2025 and Windows 11 versions 23H2 through 26H1, with fixed builds specified per-release in the MSRC advisory. The CVSS 7.1 score reflects genuine barriers - high attack complexity (AC:H) and required user interaction (UI:R) - despite full C/I/A impact potential; no public exploit or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in Windows Spaceport.sys (the Storage Spaces kernel driver) allows a low-privileged authenticated attacker to achieve full system compromise via a numeric truncation error that triggers a heap-based buffer overflow. The vulnerability affects Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 across multiple feature updates, with fixed build numbers confirmed by Microsoft through MSRC. No public exploit identified at time of analysis, but the local LPE class in kernel drivers is historically a high-priority target for post-exploitation toolkits.
Command injection in the Windows Program Compatibility Assistant (PCA) Service enables local privilege escalation across a broad range of Windows 10, Windows 11, and Windows Server editions. An authenticated low-privilege attacker can inject shell commands through the PCA service's unsanitized input handling (CWE-77), achieving full control of the local system with C:H/I:H/A:H impact. No public exploit code or CISA KEV listing is identified at time of analysis, but the wide Windows install base and low exploitation complexity make patching high priority.
Privilege escalation via an out-of-bounds read in the Windows NTFS kernel driver (CWE-125) enables a local attacker with standard user-level access to gain SYSTEM-level control of the affected host. The vulnerability spans an exceptionally broad range of Windows versions - from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making virtually every unpatched Windows environment in the field potentially exposed. Microsoft has confirmed and released patches via MSRC; no public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Office Access enables remote code execution when a user opens a specially crafted Access database file. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) confirms unauthenticated network delivery requiring only a single user interaction - consistent with a malicious file attachment or download attack pattern. No public exploit code or CISA KEV listing has been identified at time of analysis, but the full-triad impact (C:H/I:H/A:H) and broad affected version range spanning Office 2016 through Microsoft 365 Apps make this a high-priority patch-cycle item.
Privilege escalation in Windows Shell affects Windows 11 (versions 23H2 through 26H1) and Windows Server 2025, enabling a locally authenticated low-privileged attacker to achieve full system compromise with no user interaction required. The root cause is CWE-306 - a critical internal Shell function that lacks an authentication or authorization gate, allowing a standard user account to invoke privileged operations and elevate to SYSTEM. No public exploit code or CISA KEV listing exists at time of analysis; Microsoft has issued patches via Windows Update.
Remote code execution in Microsoft Windows Remote Desktop Services stems from a use-after-free (CWE-416) that a network attacker can trigger without authentication or user interaction to run arbitrary code on the target host. It affects a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through Server 2025), and Microsoft has released fixes. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Remote code execution in Windows Active Directory Domain Services allows unauthenticated network attackers to exploit a use-after-free memory corruption flaw and execute arbitrary code on domain controllers. The vulnerability spans virtually the entire Windows Server ecosystem from 2012 through 2025 and extends to Windows 10 and Windows 11 client builds running AD DS components, creating an exceptionally broad attack surface across enterprise environments. Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Microsoft Visual Studio and .NET affects multiple release branches and allows a remote unauthenticated attacker to execute arbitrary code on a victim's machine when the victim interacts with malicious content. Affected scope spans Visual Studio 2022 (17.14.x), Visual Studio 2026 (18.9.x), and the full current .NET runtime family (8.0, 9.0, 10.0, 11.0 RC1) as well as legacy .NET Framework branches from 3.5 through 4.8.1. Microsoft has released patches for all affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Remote Desktop Protocol (RDP) affects virtually every supported Windows version, from Server 2012 R2 through Windows 11 26H1 and Server 2025, enabling unauthenticated remote code execution when a victim initiates an RDP connection. The CWE-122 flaw corrupts heap memory during RDP protocol processing, allowing an attacker to hijack execution flow and achieve full confidentiality, integrity, and availability compromise of the affected system. No public exploit has been identified at time of analysis; a vendor-released patch is available across all affected Windows release tracks.
Use-after-free in the Windows Wireless Networking subsystem enables a locally authenticated low-privileged attacker to escalate to full system privileges on a wide range of Windows 10, Windows 11, and Windows Server editions. The vulnerability carries CVSS 7.0 (AV:L/AC:H/PR:L) reflecting that exploitation is locally constrained and requires navigating high-complexity timing conditions typical of UAF race conditions, but the resulting impact is complete C/I/A compromise. Microsoft has released patches across all affected release branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Remote Desktop Services (RDS) enables low-privilege authenticated network attackers to achieve remote code execution across a broad range of Windows client and server platforms, from Windows Server 2012 through Windows Server 2025 and Windows 10 through Windows 11. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms the attack requires an authenticated session and elevated exploitation complexity, yielding a base score of 7.5. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches are available covering 19 distinct OS build lines.
Local privilege escalation in Windows Error Reporting (WER) allows a low-privileged authenticated user to gain SYSTEM-level access via a heap-based buffer overflow. The vulnerability affects a wide range of Windows desktop and server editions from Windows 10 1809 through Windows 11 26H1 and Windows Server 2019 through 2025. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low-complexity, no-interaction CVSS vector makes this a practical post-exploitation stepping stone.
Heap-based buffer overflow in Spaceport.sys - the Windows kernel-mode driver for Storage Spaces - allows a low-privileged authenticated attacker to escalate to SYSTEM-level privileges over a network, with full confidentiality, integrity, and availability impact. Every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 is affected before the patched builds. Microsoft has released patches via the MSRC advisory; no public exploit or CISA KEV entry has been identified at time of analysis.
Remote code execution in Windows Media Foundation exposes virtually all supported Windows releases to heap buffer overflow exploitation via network-delivered media content. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates an unauthenticated attacker can trigger the flaw by enticing a user to open or stream a maliciously crafted media file, resulting in full confidentiality, integrity, and availability compromise of the affected process. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow (CWE-121) in the Windows DHCP Server role enables unauthenticated remote code execution across Windows Server versions spanning 2012 through 2025. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network exploitation without authentication or user interaction, moderated by high attack complexity requiring precise exploitation conditions. Microsoft has released patched builds for all confirmed affected versions; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in Windows Fax Service (CWE-122) enables local privilege escalation to SYSTEM on a broad range of Windows client and server editions spanning Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated low-privileged local user can trigger the overflow with low attack complexity (AC:L), achieving full confidentiality, integrity, and availability impact (C:H/I:H/A:H). Microsoft has released patches; no public exploit or CISA KEV listing has been identified at time of analysis.
Stack-based buffer overflow in the Windows MIDI Service Module enables local privilege escalation on Windows 11 systems across three major release branches. An authenticated local attacker with standard user privileges (PR:L) can trigger the overflow with low complexity and no user interaction, achieving full SYSTEM-level compromise (C:H/I:H/A:H). Microsoft has released patches covering Windows 11 versions 24H2, 25H2, and 26H1; no public exploit or KEV listing is present at time of analysis.
Privilege escalation via out-of-bounds read in Windows NTFS affects a broad range of Windows client and server releases, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An authorized (low-privilege) network attacker who can trigger specific NTFS parsing behavior - requiring user interaction - can achieve full compromise of confidentiality, integrity, and availability, effectively gaining system-level access. No public exploit has been identified at the time of analysis, but a vendor-released patch is available and should be prioritized given the breadth of affected OS versions.
Stack-based buffer overflow in the Windows USB Driver allows an authenticated low-privileged attacker to escalate privileges to SYSTEM-level access, with the CVSS vector indicating network-based exploitation (AV:N) requiring user interaction. The vulnerability affects a wide range of Windows versions from Windows 10 1809 through Windows 11 25H2/26H1 and Windows Server 2019 through 2025. No public exploit code has been identified at time of analysis, and the attack vector's network classification combined with a USB driver component is atypical - likely involving USB-over-network redirection features (e.g., Hyper-V or Remote Desktop USB redirection) rather than physical USB enumeration.
Local privilege escalation in Windows Secure Kernel Mode exploits an untrusted pointer dereference (CWE-822) to allow a low-privileged local attacker to elevate to full kernel-level control across a broad range of Windows 10, 11, and Server releases. The Secure Kernel Mode (SKM) context - part of Windows Virtualization-Based Security (VBS) operating at Virtual Trust Level 1 (VTL1) - means successful exploitation bypasses standard OS-kernel isolation, making this structurally more severe than a conventional LPE. No public exploit identified at time of analysis; vendor-released patches are available via Microsoft's July 2026 security update cycle.
Local privilege escalation in Windows Image Acquisition (WIA) through a use-after-free memory corruption flaw allows a low-privileged authenticated local user to gain full SYSTEM-level control. The vulnerability spans an exceptionally broad range of Microsoft Windows releases - from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making patch scope significant across virtually all enterprise Windows environments. No public exploit code or CISA KEV listing has been identified at time of analysis, and the high attack complexity rating (AC:H) suggests reliable exploitation requires precise timing or heap manipulation skill.
Remote code execution in Windows Imaging Component (WIC) is possible via an integer overflow (CWE-190) triggered when processing a maliciously crafted image file, affecting virtually every supported and legacy Windows release from Server 2012 through Windows 11 26H1. An unauthenticated network-based attacker can deliver a specially crafted image that causes an integer wraparound in WIC's parsing logic, leading to arbitrary code execution in the context of the target user. No public exploit or CISA KEV listing has been identified at time of analysis, but the breadth of affected platforms and low attack complexity make this a high-priority patching target.
Privilege escalation in the Windows Win32K kernel-mode GUI subsystem allows a low-privileged local user to gain SYSTEM-level access via a use-after-free memory corruption condition. The vulnerability affects a broad span of Windows 10, Windows 11, and Windows Server 2019/2022/2025 releases, making it highly relevant to enterprise endpoint and server environments. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches across all affected version branches.
Remote code execution in the Windows Compressed Folder (zipfldr / built-in ZIP shell handler) affects a broad range of supported Windows client and server releases, from Windows Server 2012 and Windows 10 through Windows 11 25H2/26H1 and Windows Server 2025. A heap-based buffer overflow (CWE-122) in the archive-parsing code lets an attacker who delivers a crafted compressed archive corrupt heap memory and execute arbitrary code. Microsoft rates it CVSS 9.8; the flaw was reported by Microsoft's own MSRC and a patch is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in the Windows Event Logging Service enables network-accessible, unauthenticated code execution with full system impact across a sweeping range of Windows client and server releases. The flaw (CWE-122) resides in the Event Logging Service - a privileged, always-running Windows component - and can be exploited by a remote attacker who induces a victim user to trigger the vulnerable code path, yielding complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected OS versions and the ubiquity of Windows deployments make this a high-priority patching candidate.
Remote code execution via a heap-based buffer overflow in the Windows Event Logging Service (CWE-122) affects a sweeping range of Windows desktop and server releases, from Windows Server 2012 through Windows 11 26H1 and Server 2025. An unauthenticated network attacker can trigger the vulnerability with user interaction, achieving full system compromise (C:H/I:H/A:H). No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch availability makes remediation immediately actionable.
Remote code execution in the Windows Event Logging Service (EventLog) affects a broad range of currently-supported Windows client and server editions, from Windows 10 1607/1809/21H2/22H2 and Windows 11 through 26H1, to Windows Server 2012 through Server 2025. An out-of-bounds read in the service's network-facing parsing path allows an unauthorized attacker to execute code over the network per Microsoft's advisory, which rates it CVSS 9.8. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the pre-auth, network-reachable profile makes it a high patch-priority item.
Heap-based buffer overflow in the Windows Partition Management Driver (partmgr.sys) enables a low-privileged local attacker to escalate privileges to SYSTEM or kernel level across virtually all supported Windows client and server releases. Exploitation requires existing low-privileged code execution on the target and high attack complexity, consistent with a race condition or precise heap-grooming technique. Microsoft has released patches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Microsoft DirectMusic component of Windows (spanning Windows 10, 11 through version 26H1, and Windows Server 2012 through 2025) allows an unauthorized attacker to execute arbitrary code by triggering a heap-based buffer overflow (CWE-122). Microsoft rates it 9.8 (AV:N/AC:L/PR:N/UI:N) and has released patches; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. DirectMusic is a legacy multimedia audio subsystem, so exploitation typically flows through malicious media content processed by the DirectMusic parser.
Heap-based buffer overflow in Windows Biometric Service (WinBioSvc) enables a low-privileged local attacker to escalate privileges to SYSTEM level. The vulnerability (CWE-122) affects an extremely wide surface - fifteen distinct Windows 10, Windows 11, and Windows Server release trains from Server 2016 through Server 2025 - making it relevant to virtually every Windows enterprise environment. No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches through Windows Update.
Local privilege escalation in the Windows Device Association Service allows a low-privileged attacker to gain SYSTEM-level access on unpatched systems via a use-after-free memory corruption bug (CWE-416). The vulnerability spans the entire current Windows ecosystem - from Windows 10 1607 and Server 2012 R2 through Windows 11 25H2 and Server 2025 - making the attack surface extremely broad. Microsoft has released patches across all affected branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in the Windows Remote Desktop Client (mstsc.exe and related components) allows a low-privileged attacker to execute arbitrary code on the victim client machine via a network connection. The root cause is CWE-908 (use of uninitialized resource), where memory that has not been properly initialized can be manipulated by a malicious RDP server to hijack execution flow on the connecting client. The vulnerability affects the RDP client component across a broad range of Windows releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025. No public exploit or KEV listing has been identified at time of analysis, but the CVSS score of 8.8 and high C/I/A impact make this a priority patching target.
Windows Error Reporting (WER) across a broad range of Windows 10, Windows 11, and Windows Server releases creates temporary files in directories with insecure permissions, enabling a local attacker with standard user privileges to tamper with those files and read their contents. The vulnerability is classified as CWE-379 and carries a CVSS 3.1 score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), reflecting high confidentiality and integrity impact achievable without elevated rights. No public exploit code has been identified at time of analysis, and Microsoft has released patches through its standard update channel.
Privilege escalation via heap-based buffer overflow in Windows Enterprise App Management affects a broad swath of Windows desktop and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. An authenticated network attacker with low privileges who can induce a target user to interact with a crafted payload can trigger the overflow and achieve full system-level compromise (High C/I/A). No public exploit code or CISA KEV listing was identified at time of analysis, but the breadth of affected Windows versions and the vendor-released patch signal a systemic component-level flaw.
Privilege escalation to SYSTEM-level via a heap-based buffer overflow in the Windows Partition Management Driver affects multiple Windows 10, Windows 11, and Windows Server releases. An authenticated local attacker with low privileges can exploit the CWE-122 heap overflow to achieve full confidentiality, integrity, and availability impact on the local system. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available through the Microsoft Security Response Center.
Heap-based buffer overflow in the Windows NTFS filesystem driver allows a local, unprivileged attacker to execute arbitrary code with full system impact. The vulnerability (CWE-122) affects an exceptionally wide range of Microsoft Windows and Windows Server releases, from Windows Server 2012 through Windows Server 2025 and Windows 10/11. The CVSS vector (AV:L/PR:N) suggests exploitation is achievable without a Windows account - consistent with a crafted NTFS volume triggering the overflow on mount, such as via removable media. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released patches.
Heap-based buffer overflow in the Windows Device Association Service enables a low-privileged local user to escalate privileges to SYSTEM level across a broad range of Windows desktop and server platforms. Affected versions span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2016 through 2025 - all prior to their respective patched builds detailed in the Microsoft MSRC advisory. Microsoft has released patches via the standard update channel; no public exploit code or CISA KEV active-exploitation listing has been confirmed at time of analysis.
Heap-based buffer overflow in Microsoft Office Access enables local code execution with full system impact when a low-privileged user opens a specially crafted database file. Affected products span Access 2016 through Microsoft 365 Apps for Enterprise, covering the majority of Microsoft Office deployments. Microsoft has released patches across all affected product lines; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Privilege escalation via heap-based buffer overflow in the Windows Biometric Service (WinBio) affects all major Windows 10, Windows 11, and Windows Server editions from version 1607 through Server 2025. An authenticated local attacker exploiting this vulnerability can corrupt heap structures within the privileged WinBio process to execute arbitrary code at SYSTEM level. No public exploit has been identified at time of analysis, and Microsoft has released patches across all fifteen affected version and edition combinations.
Privilege escalation in Windows Remote Desktop Services exploits an untrusted pointer dereference (CWE-822) to allow a locally authenticated low-privileged attacker to gain full system control (C:H/I:H/A:H). The flaw affects a broad swath of Windows versions from Server 2012 through Server 2025 and Windows 10/11 across multiple feature update branches. No public exploit code or active exploitation has been identified at time of analysis, but Microsoft has released patches via the standard update cycle.
Privilege escalation in the Windows Kernel via a use-after-free memory corruption flaw allows an authenticated local attacker to elevate from low-privileged user to SYSTEM-level access. The vulnerability spans the entire current Windows ecosystem - from legacy Windows Server 2012 through Windows 11 26H1 and Windows Server 2025 - making it broadly relevant to enterprise patch management. No public exploit code or active exploitation has been identified at time of analysis, but the breadth of affected OS versions and the practical value of local EoP payloads in post-initial-access attack chains make timely patching essential.
Use-after-free in the Windows Human Interface Devices kernel subsystem allows a local, low-privileged user to escalate to SYSTEM-level control. Affecting virtually all current Windows desktop and server releases - Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), Windows Server 2016 through 2025 - successful exploitation requires local session access and precise timing but yields full C:H/I:H/A:H kernel impact. No active exploitation has been confirmed (no CISA KEV listing) and no public proof-of-concept is known; Microsoft has released patches for all affected build branches.
Local privilege escalation in the Windows Connected User Experiences and Telemetry service (DiagTrack/utcsvc) exposes a use-after-free memory condition allowing an authenticated local attacker to achieve full SYSTEM-level control. The vulnerability carries CVSS 7.0 with AC:H, indicating a race-condition or timing-dependent trigger that elevates exploitation difficulty but does not preclude reliable use in post-breach scenarios. Microsoft has released patched builds across all affected Windows client and server SKUs; no public exploit code has been identified at time of analysis.
Local privilege escalation in the Windows Volume Manager Extension Driver allows a low-privileged authenticated user to gain full SYSTEM-level control via a heap-based buffer overflow (CWE-122). The vulnerability spans an exceptionally wide range of Windows versions - from the legacy Windows Server 2012 and Windows 10 1607 through the current Windows 11 26H1 and Windows Server 2025 - making patching scope a significant operational challenge. No public exploit code or CISA KEV listing has been identified at the time of analysis, and the CVSS AC:H metric reflects meaningful exploitation complexity, but the vulnerability's kernel-mode scope and full C:H/I:H/A:H impact make it a high-value post-compromise tool.
Stack-based buffer overflow in the Microsoft Graphics Component enables a locally authenticated attacker with standard user privileges to escalate to full system control across Windows 10 and Windows 11. The flaw (CWE-121) is triggered locally with low complexity and no user interaction, yielding high confidentiality, integrity, and availability impact per the CVSS:3.1 vector. No public exploit code or CISA KEV listing is identified at time of analysis, but the low-privilege requirement and zero interaction needed make this a realistic post-compromise escalation primitive.
Local privilege escalation in the Windows Kernel across virtually all supported Windows releases exploits a time-of-check time-of-use (TOCTOU) race condition (CWE-367) to elevate from low-privilege user to SYSTEM. An authenticated local attacker wins a race between when the kernel validates a resource and when it uses it, substituting a different object between those two moments. No public exploit has been identified at time of analysis, and Microsoft has released patches across all affected versions as part of a coordinated update cycle.
Remote code execution in Microsoft SharePoint Server Subscription Edition is reachable by authenticated network users due to missing authorization checks (CWE-862). An attacker holding any valid SharePoint credentials can invoke privileged server-side functionality without proper authz enforcement, achieving full compromise of confidentiality, integrity, and availability. No active exploitation is confirmed in CISA KEV at time of analysis, and no public exploit code has been identified.
Privilege escalation in Microsoft SharePoint Server Subscription Edition enables any authenticated network user to gain elevated privileges with full confidentiality, integrity, and availability impact. The root cause is CWE-250 (Execution with Unnecessary Privileges), where a SharePoint service or component operates with more privilege than its function requires, allowing a low-privileged account to cross privilege boundaries. No active exploitation has been confirmed and no public exploit code has been identified; a vendor patch is available targeting build 16.0.20326.20090.
Remote code execution in the Windows NTFS file-system driver stems from a heap-based buffer overflow (CWE-122) reachable by an unauthorized attacker over a network, per Microsoft's advisory. The flaw affects a very broad range of supported Windows client and server builds from Windows Server 2012 through Server 2025 and Windows 10/11 up to version 26H1. Microsoft rates it CVSS 9.8 and has released patches; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Heap-based buffer overflow in Windows Error Reporting (WER) enables network-based privilege escalation across a broad range of Windows desktop and server versions. An authenticated low-privileged attacker who can trigger user interaction can exploit the overflow to achieve full confidentiality, integrity, and availability compromise - effectively gaining SYSTEM-level control. No public exploit code has been identified at time of analysis, but the breadth of affected versions (Windows 10 through Server 2025) and the ubiquity of WER in Windows deployments make this a high-priority patch item.
Stack-based buffer overflow in Windows NTFS (CWE-121) enables remote code execution across a broad range of Microsoft Windows desktop and server editions. An unauthenticated network attacker can trigger the overflow with user interaction, achieving full compromise of confidentiality, integrity, and availability on the target system. The vendor-confirmed patch is available via Microsoft's update channel; no active exploitation or public exploit code has been identified at time of analysis.
Use-after-free in Windows Modern Device Management (MDM) enables a low-privileged authenticated attacker to escalate to SYSTEM-level privileges across a broad swath of Windows 10, Windows 11, and Windows Server releases. The CVSS vector (AV:N/AC:H/PR:L/UI:R) indicates the attack is network-reachable but constrained by high exploitation complexity and required user interaction, limiting opportunistic mass exploitation. Microsoft has released patched builds; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Windows Power Dependency Coordinator component allows a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on affected Windows 10, Windows 11, and Windows Server systems. The flaw (CWE-122) requires only a local account and no user interaction, making it a reliable post-compromise escalation primitive. No public exploit code has been identified at time of analysis, and it does not appear in the CISA KEV catalog, but the low attack complexity (AC:L) and broad platform coverage across Windows 10 through Server 2025 make patching a priority in any environment where insider threat or malware post-exploitation is a concern.
Privilege escalation via out-of-bounds read in Windows BitLocker affects a broad swath of Microsoft operating systems from Windows Server 2012 through Windows Server 2025 and Windows 10/11 across multiple feature updates. A low-privileged network-authenticated attacker who can induce user interaction can trigger CWE-125 memory reads beyond buffer boundaries in the BitLocker component, ultimately achieving elevation of privileges with full confidentiality, integrity, and availability impact (CVSS 8.0). No public exploit code or CISA KEV listing has been identified at time of analysis; Microsoft has released patches addressing all confirmed affected versions.
Heap-based buffer overflow in Microsoft Windows Speech (CWE-122) allows a local low-privileged attacker to escalate to SYSTEM-level privileges with no user interaction required. The vulnerability spans the entire modern Windows platform - Windows 10 (versions 1607 through 22H2), Windows 11 (versions 23H2 through 26H1), and Windows Server 2016 through 2025 - making the attack surface exceptionally broad. No public exploit code or CISA KEV entry has been identified at time of analysis; however, the vendor patch is confirmed available via MSRC.
Heap-based buffer overflow in the Windows Remote Access Connection Manager (RASMAN) service enables local privilege escalation to SYSTEM on a broad range of Windows desktop and server editions, from Windows 10 1607 through Windows 11 26H1 and Server 2012 R2 through Server 2025. An authenticated attacker with a low-privilege local foothold can exploit the overflow with low complexity and no user interaction, achieving full confidentiality, integrity, and availability compromise (CVSS 7.8, AV:L/AC:L/PR:L). No public exploit identified at time of analysis, and Microsoft has released patches across all affected product lines via MSRC.
Use-after-free in Windows Management Instrumentation (WMI) enables an authenticated low-privilege attacker operating over a network to escalate privileges on affected systems, with full confidentiality, integrity, and availability impact when successfully exploited. The CVSS vector (AC:H/UI:R) reflects meaningful exploitation complexity - a specific race condition must be won and some form of user interaction is required, constraining opportunistic mass exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the breadth of affected Windows versions - from Server 2012 to Server 2025 and Windows 10/11 across all current branches - makes patch prioritization important for enterprise environments.
Local privilege escalation in Windows Error Reporting (WER) across virtually all supported Windows releases exploits an out-of-bounds read (CWE-125) to allow a low-privileged authenticated local user to gain SYSTEM-level access with full confidentiality, integrity, and availability impact. The breadth of affected platforms is significant, spanning Windows 10 versions 1607 through 22H2, Windows 11 versions 23H2 through 26H1, and Windows Server 2012 through Server 2025 including Server Core installations. No public exploit code has been identified at time of analysis, and Microsoft has released patches through the standard Windows Update channel.
Privilege escalation in the Windows Bluetooth Service allows a low-privileged local attacker to gain SYSTEM-level access by exploiting a race condition in shared resource handling. Affected versions span Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, Windows Server 2022, and Windows Server 2025. Microsoft has released patched builds; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows Audio Service (AudioSrv) enables a locally authenticated low-privileged attacker to escalate privileges to SYSTEM on affected Windows 11 and Windows Server 2025 builds. The vulnerability (CWE-122) carries a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting low exploitation complexity once a local foothold is established. Microsoft has released patches across all affected build lines; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Path traversal in the Windows Compressed Folder built-in ZIP handler allows a locally authenticated standard user to escalate privileges to SYSTEM or Administrator level across a wide range of Windows client and server editions. The vulnerability (CWE-22) exists in the component that processes ZIP archive extraction, enabling crafted archive entries to write files outside the intended extraction directory into sensitive system paths. No public exploit or KEV listing exists at time of analysis, but the low attack complexity and broad version coverage across Windows 10, 11, and Server 2012 through 2025 make this a high-priority patching target in environments where local privilege escalation is a concern.
Heap-based buffer overflow in Microsoft Windows Speech enables local privilege escalation across Windows 10, Windows 11, and Windows Server platforms from 2016 through 2025. An authorized local attacker holding only a standard user account can exploit the CWE-122 flaw without user interaction to obtain full system compromise (C:H/I:H/A:H), effectively achieving SYSTEM-level privileges. Vendor-supplied patches are available via MSRC; no public exploit code has been identified at time of analysis.
Out-of-bounds read in the Windows Device Health Attestation (DHA) service exposes sensitive memory contents to unauthenticated remote attackers. The flaw affects Windows 10 Version 1809, Windows Server 2019, 2022, and 2025, where a crafted network request can trigger the read beyond an allocated buffer, leaking high-confidentiality data. Microsoft has released patches for all affected builds, and no public exploit or active exploitation has been identified at time of analysis.
Remote code execution in Microsoft Office exposes unauthenticated network attackers to full system compromise when a target user opens a specially crafted document. The root cause is a heap-based buffer overflow (CWE-122) in Office's document parsing logic, affecting Office 2016 through Microsoft 365 Apps for Enterprise across a defined range of 16.x builds confirmed by EUVD-2026-73711. No public exploit or CISA KEV listing has been identified at time of analysis, but the CVSS 8.8 score with a network attack vector and no required attacker privileges - beyond inducing user file-open interaction - reflects a credible, high-impact threat against the world's most widely deployed office productivity suite.
Local privilege escalation in Windows Installer (msiexec) allows a low-privileged authenticated user to gain full SYSTEM-level control by exploiting a race condition on a shared resource during installer operations. The vulnerability is present across a broad swath of Windows desktop and server releases, from Windows Server 2012 through Windows Server 2025 and Windows 11 26H1. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CVSS High score (7.0) and full C:H/I:H/A:H impact reflect the severity of a successful escalation.
Privilege escalation in the Windows MIDI Service Module on Windows 11 enables a low-privileged local attacker to gain full system control by exploiting a time-of-check time-of-use (TOCTOU) race condition (CWE-367). Affected builds span all three actively supported Windows 11 release tracks - 24H2, 25H2, and 26H1 - and Microsoft has released patches for each. No public exploit code or CISA KEV listing has been identified at time of analysis, so exploitation at scale is not currently confirmed.
Remote code execution in Microsoft JScript's numeric type conversion logic allows unauthenticated network attackers to execute arbitrary code on affected Windows hosts. The vulnerability stems from CWE-681 (incorrect conversion between numeric types) in jscript.dll, the legacy Windows scripting engine, and affects the full span of supported Windows releases from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. No public exploit has been identified at time of analysis, but the network-reachable, zero-interaction CVSS vector (AV:N/UI:N) indicates exploitation via server-side JScript processing contexts such as IIS Classic ASP, without requiring user interaction.
Privilege escalation in Windows Error Reporting (WER) via a heap-based buffer overflow (CWE-122) allows an authenticated local attacker - holding only standard user privileges - to achieve full system compromise across all current Windows 10, Windows 11, and Windows Server 2019/2022/2025 builds. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) reflects low attack complexity and no interaction requirement, making this an effective land-and-escalate primitive for threat actors with any initial foothold on a target host. Vendor patch is available from Microsoft; no public exploit has been identified at time of analysis.
Heap-based buffer overflow in Windows URL Moniker (urlmon.dll) enables remote code execution across nearly every supported Windows release when a user interacts with attacker-controlled content. The vulnerability spans Windows Server 2012 through Server 2025 and Windows 10/11 across all major feature updates, making the attack surface exceptionally broad. No public exploit or CISA KEV listing has been identified at time of analysis, but vendor patch availability and the network-accessible, user-interaction-triggered attack vector place this firmly in the urgent-patching tier.
Heap-based buffer overflow in Windows Error Reporting (WER) enables a locally authenticated attacker to escalate privileges to SYSTEM or administrative level on affected Windows endpoints and servers. The vulnerability spans virtually the entire supported Windows ecosystem - from Windows 10 1607 and Server 2016 through Windows 11 26H1 and Server 2025 - making the blast radius exceptionally broad. No public exploit code has been identified at time of analysis, but the local privilege escalation primitive is highly valuable for post-compromise attackers pivoting from user-level access.
Privilege escalation to SYSTEM via heap-based buffer overflow in the Windows Volume Manager Driver (a kernel-mode component) affects virtually every supported Windows client and server release, from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. An attacker with an existing low-privileged local account can trigger the overflow to corrupt kernel heap structures and gain full SYSTEM-level control without any user interaction. Microsoft has released patches across all affected product lines; the vulnerability carries a CVSS 7.8 local privilege escalation rating with low attack complexity.
Use-after-free in Windows Embedded Mode Service allows a locally authenticated attacker with low privileges to escalate to SYSTEM-level access across virtually all supported Windows versions. The memory corruption occurs when the service accesses a previously freed object, enabling an attacker to manipulate heap layout and execute code in a privileged context. No public exploit or active exploitation (KEV) has been identified; Microsoft has released patches via Windows Update, and the AC:H rating reflects the timing-dependent race-condition exploitation typical of UAF primitives.